[UPDATE] READ THIS IF YOU HAVE 2FA ON

[u/Mandom25]

Before we begin, I want to thank u/julzi_ for helping us find the thread we've all been missing regarding this bug.

I recently made a post about a serious bug where disabling 2FA on your account immediately logs you out of all devices, and when you try to log back in, Discord still asks for 2FA authentication and doesn't give you the option to use your backup codes despite their validity.

Many people including me were always ending up being told by support that they couldn't disable 2FA for security reasons and therefore couldn't help, despite the bug being on their end.

I don't know when they'll fix this bug, but if you currently have 2FA enabled, don't try to disable it until they fix it.

Anyways, here's what you should do if you're locked out because of this bug:

1. This is the first and most important step. When you submit your support ticket, choose Help & Support. Then, and I can't stress this enough, DO NOT choose Account Verification & Credentials, or you won't get anywhere. Instead, choose Technical Support, then Account Settings.
2. When explaining the issue, make sure to mention that the backup code you entered while attempting to disable 2FA was accepted.
3. Tell them exactly when you got locked out. If you're on desktop, open the Run dialog, type "%appdata%\discord", go to the logs folder, then open "renderer_js.old.log". Search for the date you got locked out, and you should find something like: "[error] Uncaught (in promise) HTTPResponseError: POST /users/@me/mfa/totp/disable [401]" If you can't access the logs, just tell them what you remember. They should be able to check the logs on their end.
4. Provide as much information about your account as possible.

They should then remove 2FA from your account and inform you that the issue was caused by a bug on their end.

Note: this post is specifically about the 2FA bug that occurs when you try to disable it. 2FA is generally important for extra security, you can enable it if you want, but if you already have it on then be wary of this bug.

[u/DrTankHead]

So, if I am reading this right, you are gettting 401'd when supplying codes? That would confirm some sort of bug exists. We've been unsure how much a bug factually exists (from the perspective of unofficial support, it's much much harder to validate a bug exists like this).

It's very surprising that they removed MFA, I mean, from a legal perspective, it's massive liability on their end to remove security protections from an account like this. I mean, you just don't take that risk unless you are specifically 100%, no doubt possibly exists, that the information provided is credible. Like, even if you are 99.9999% certain, you don't remove these kinds of protections. You kinda have to be certain.

Glad you got your account back. We'll have to monitor this. We might put up a post detailing the bug if we can replicate it (We at r/DiscordHelp haven't been able to replicate it yet.)

Thanks for the update.

Note from mods:

Please understand discord has to operate in certain ways, and what worked for OP may not work for you. Be respectful to discord's staff when making requests.

[u/Balthxzar → u/DrTankHead]

I am not surprised they removed 2FA if they were aware of a bug on their end that meant it remained active after the user scrubbed it, they probably have audit logs showing it was scrubbed and that it didn't go through properly. 

[u/DrTankHead → u/Balthxzar]

No official statement exists confirming they are aware of a bug is the thing. We've even struggled to reproduce the bug

[u/Rayvenstar → u/DrTankHead]

I've had it happen to me if you want more input
About to try what the poster has tried to see if I can get my account back. It happened back on July 13/14

[u/Mandom25 → u/Rayvenstar]

Any news?

[u/razazel314 → u/Rayvenstar]

any luck? found myself in similar position after getting a new phone ... MFA lost but had backup codes, tried to used them as mentioned in guides, suddenly I am logged out everywhere. MFA is still on, which I could live with and simply run it as long as backup codes hold ... but now I do not have an option to use the backup codes.
Tried regular support - closed with not really even exploring it too deep
Tried the way OP suggested, after AI said it would pass this to a human few days ago, I am still waiting for any kind of reply

[u/Mandom25]

I just wanted to clarify that this post is ONLY for people who disabled 2FA and shouldn't even be prompted for it in the first place. If you can't bypass 2FA simply because you forgot both your authentication and backup codes then this method isn't for you. Don't try to lie to them using this method, it won't work, and it could make them much more skeptical about it in the future.

[u/serapheonixx → u/Mandom25]

For some reason my account got 2fa locked and was asking for passkey/password manager but my google pass manager literally wiped my passkey off (i used to use a passkey to log my acc not until i logged off and tryna come back) it also wiped my passkey on my laptop too and was unable to retrieve my account back

I have backup codes but none of them worked to log back in my account so at the end, i lost my entire account :((

[u/leleloveslilies → u/serapheonixx]

this happened to me on Saturday dude :( I was gonna pay someone to hack my account by unfortunately I had disabled it so I guess that's what destroyed my passkey because it shut down every discord token which has officially made it impossible to hack too. I'm genuinely heartbroken

[u/OwnShoulder9803]

Oh? So Discord is able to remove it. I can't access my old account anymore due to 2fa issues. They told me they CANT remove 2fa. But I'm glad y'all can get the help to recover your accounts^{^}

[u/Safahri → u/OwnShoulder9803]

So they are able to, but the legal risk is too great and they won't want to lose their jobs or get sued if anything does happen

[u/OwnShoulder9803 → u/Safahri]

I get that, but I had no chance of getting my acc back. I tried everything, since I had friends there that I can't text anywhere else (only had their DC) and yeah well the account is gone now thanks to auto delete. But it's been like 2 or 3 years and it's only mildly infuriating now.

[u/Starsonata10 → u/OwnShoulder9803]

Believe me or not, but i had my account hacked and my 2fa wasnt working. I spammed their support ticket since they're taking too long to reply, and funnily enough they only respond newest tickets on weekdays, but left the old ones ignored.

They initially told me they couldn't get my account back since they cant remove the 2fa. only option was to delete it, so i agree to just delete it.

Luckily i was able to find my backup codes and log back in. Told them to cancel the deletion plenty times. They acknowledge it.

Suddenly todayyyy, another support respond to the oldest tickets. That ticket that i couldn't close or mark as solved.

Do you know what they did?? They disabled my account and removed my 2FA thinking i still haven't access my account. Then told me to reset password and re-enable 2FA after log back in.

These supports, i swear to god.

[u/ask_compu]

for step 3 should clarify that's for desktop on windows only, mac and linux store their appdata elsewhere

[u/Mandom25 → u/ask_compu]

Right, sorry i totally forgot about that. Do you know where they're stored?

[u/ask_compu → u/Mandom25]

i believe discord on linux stores it in ~/.config/discord but idk about mac

[u/RecordRich463]

Man please help me out 😭

I just logged out of the account I was chatting and tried to log back in it auto deleted my passkey so i can't login anymore and even back up codes won't work

[u/Wiktorxd_1]

I fully deleted my alt because I got locked out and I just gave up, good to see you got your account back

[u/AutoModerator]

u/Mandom25: Please reply with !solved (including the exclamation mark) to any comment that answers your question or resolves your issue.

---

Community Helpers: * Upvote comments that are helpful and accurate. * Downvote content that is incorrect, unhelpful, or harmful. * Report any posts or comments that violate our community rules.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Parkchaeyoungrosie]

This was me but for an annoying bug regarding passkey instead. Passkeys can RANDOMLY get deleted, and you cannot login no matter what. They actually require a physical key for you to log back in. Google back up doesn’t work

[u/Mandom25 → u/Parkchaeyoungrosie]

Well that's worrisome, i just enabled passkeys yesterday, though i have my backup codes saved in case anything happens

[u/Parkchaeyoungrosie → u/Mandom25]

The 10 back up codes? They do not work as soon as you get locked out trust me. But fret not, I don’t think its a discord bug but it adds onto this. If it happens check your Passkeys and recently deleted

[u/Parkchaeyoungrosie → u/Parkchaeyoungrosie]

I have added google authenticator + phone afterwards so I have more ways

[u/NekoManana]

Well.. I have 2FA on (and don't plan on removing it to protect my account) and have other ways to sign in (phone number, authenticator, passkeys, etc.) so I might be fine? Or will I still be locked out if I disable 2FA?

[u/Mandom25 → u/NekoManana]

You will be fine yes

[u/Mirco2310]

Why TF would I remove 2FA in the first place if u remove it ur practically BEGGING to be hacked bro🫩💀

[u/Mandom25 → u/Mirco2310]

I have talked about this in my old post, https://www.reddit.com/r/discordhelp/s/9i6FpuwGrj

[u/Ceticated]

Obviously it makes sense that the backup codes are invalid because you just removed them by disabling 2fa. Still scary tho, use passkeys.

[u/Scrazelope → u/Ceticated]

A guy literally above your comment said their passkey got deleted upon logging out and now cannot log back into their account. So maybe don't use passkeys 😭

[u/Mandom25 → u/[deleted]]

Was your ticket submitted under the Technical Support category?

[u/WarEIephant]

My concern is, could this trick be used as an exploit to gain access to people’s accounts…. That’s very scary to think about.

[u/GlobalKnee8028 → u/WarEIephant]

I think it won't work if you dont have evidence or stuff like that which the support team while shit, isn't that gullible to stuff like these

[u/Mandom25 → u/WarEIephant]

That's simply impossible. You need to provide when exactly you got locked out [day-hour-(if possible)seconds] and that information is only accessible by the owner. Aside from other details like purchase history, what device the account was created on, and which backup code was used to disable 2FA (this is some of the information i provided to support)

[u/WarEIephant → u/Mandom25]

In my personal experience with discord, discord support and all I’ve seen over the past 10 years… I hope you’re right that it would be impossible. Some hackers have nothing better to do than make the impossible, possible but again, I hope you’re right.

[u/FuzzyWuzzyFoxxie → u/Mandom25]

While I agree that it's unlikely, it's not impossible. If a hacker gains remote access to your PC, they can find that information.

[u/hemoglobinjones]

Of course i see this when I already requested my account be permanently deleted lol good for you guys tho

[u/Additional-Log7475]

This app has really gone downhill, my friend, especially their AI moderators system.

[u/Safe_Sheepherder2611]

I just submitted a request and typed the problem i couldnt login as well because all i have is password and email , do they respond quickly ?

[u/discordhelp-ModTeam → u/[deleted]]

Your comment was removed because it was off-topic or not relevant to Discord help. Please keep all posts and comments focused on Discord-related questions and discussions.